diff options
| author | Alexey Dobriyan <adobriyan@sw.ru> | 2008-04-14 03:56:02 -0400 |
|---|---|---|
| committer | Patrick McHardy <kaber@trash.net> | 2008-04-14 03:56:02 -0400 |
| commit | 666953df353194bef76086fa3f126241cbac3e3a (patch) | |
| tree | bd69afed2996b0a521361efcd29e32ea7606e9ff /lib | |
| parent | 36e2a1b0f7f2598e38952494b91490f58aa221c8 (diff) | |
[NETFILTER]: ip_tables: per-netns FILTER/MANGLE/RAW tables for real
Commit 9335f047fe61587ec82ff12fbb1220bcfdd32006 aka
"[NETFILTER]: ip_tables: per-netns FILTER, MANGLE, RAW"
added per-netns _view_ of iptables rules. They were shown to user, but
ignored by filtering code. Now that it's possible to at least ping loopback,
per-netns tables can affect filtering decisions.
netns is taken in case of
PRE_ROUTING, LOCAL_IN -- from in device,
POST_ROUTING, LOCAL_OUT -- from out device,
FORWARD -- from in device which should be equal to out device's netns.
This code is relatively new, so BUG_ON was plugged.
Wrappers were added to a) keep code the same from CONFIG_NET_NS=n users
(overwhelming majority), b) consolidate code in one place -- similar
changes will be done in ipv6 and arp netfilter code.
Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Diffstat (limited to 'lib')
0 files changed, 0 insertions, 0 deletions